thanks jon...

we hav configured the acl statement to be acl intranet icmp any any...is there a problem ..bcoz...we both cant ping each other..we hav a chkpoint fw in our end...

Hi

Do you mean pinging from a client on one network to a client on the other.

If your applications are working but icmp not and you have allowed icmp in then it sounds like icmp is getting blocked on the return path.

Could you send pix config (sanitised).

Jon

Hi,

You may also ask the customer with the pix to run a debug icmp trace command, then preform tests to see the packets are processed. I will share that I am having problems pinging from our asa/pix as the source to devices inside the vpn tunnel at the other end. Pings do work fine however between devices connected behind the firewalls at both ends of the tunnel.

In my debugs, I found that the asa/pix sources it's address in the pings as the external public address associated to the outside interface.

Understandably this address should never be allowed to ping an internal private address on the the other end of the tunnel.

I am about to open a discussion forum inquiring on this as well as a tac case.

Good luck with your tests and please rate if this is helpful.

-Scott